6 matches found
CVE-2024-29137
The WordPress Tourfic plugin is affected up to version 2.11.7 with a Reflected XSS vulnerability in the place parameter due to insufficient input sanitization and output escaping. This can allow attackers to execute scripts in users’ browsers. Remediation: upgrade to Tourfic 2.11.8 or later. The ...
CVE-2024-29136
CVE-2024-29136 affects the Tourfic WordPress plugin from Themefic, vulnerable to PHP Object Injection via deserialization of untrusted data in all versions up to 2.11.17. The vulnerability requires at least Subscriber+ authentication and could enable attacker-controlled object injection. Public s...
CVE-2024-29135
CVE-2024-29135 affects the Tourfic WordPress plugin (
CVE-2024-12032
CVE-2024-12032 is a SQL Injection affecting the Tourfic – Ultimate Travel Booking, Hotel Booking & Car Rental WordPress Plugin (WooCommerce Booking). The vulnerability exists in the tf_enquiry_reply_email_callback function and is triggered via the enquiry_id parameter, due to insufficient escapin...
CVE-2024-29134
CVE-2024-29134 affects the Tourfic WordPress plugin (versions up to 2.11.8). It is a Stored XSS due to improper neutralization of input during web page generation. The issue is fixed in Tourfic 2.11.9; administrators should upgrade to the fixed version to mitigate the vulnerability. The connected...